Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

An intrusion detection system is software that monitors a single or a network of computers for malicious activities that are aimed at stealing or censoring information or corrupting network protocols. Most technique used in today’s intrusion detection system are not able to deal with the dynamic and complex nature of cyber-attacks on computer networks. Even though efficient adaptive methods like various techniques of machine learning can result in higher detection rates, lower false alarm rates and reasonable computation and communication cost. With the use of data mining can result in frequent pattern mining, classification, clustering and mini data stream. This survey paper describes a focused literature survey of machine learning and data mining methods for cyber analytics in support of intrusion detection. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in machine learning and data mining approaches, some well-known cyber data sets used in machine learning and data mining are described for cyber security is presented, and some recommendations on when to use a given method are provided.